CVE-2026-23058

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak

Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:

gs_usb_receive_bulk_callback(): fix URB memory leak").

In ems_usb_open(), the URBs for USB-in transfers are allocated, added to

the dev->rx_submitted anchor and submitted. In the complete callback

ems_usb_read_bulk_callback(), the URBs are processed and resubmitted. In

ems_usb_close() the URBs are freed by calling

usb_kill_anchored_urbs(&dev->rx_submitted).

However, this does not take into account that the USB framework unanchors

the URB before the complete function is called. This means that once an

in-URB has been completed, it is no longer anchored and is ultimately not

released in ems_usb_close().

Fix the memory leak by anchoring the URB in the

ems_usb_read_bulk_callback() to the dev->rx_submitted anchor.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References